Getting Data In

Perfmon: Unable to get data from index search

prsubramanian
New Member

Hi,
I want to get the CPU Usage of windows host - CPU Usage, so trying to get the CPU Usage using counters = % Processor Time; from below inputs.conf

Inputs.conf:

[perfmon://Host Process]
_TCP_ROUTING = Infra_monitoring_indexer1
counters = % Processor Time; Thread Count; ID Process; Private Bytes; IO Read Operations/sec; IO Write Operations/sec; Virtual Bytes; Page File Bytes
disabled = 0
instances = *
interval = 60
object = Process
index = Process_tier1_idx
showZeroValue = 1

Path: C:\Program Files\Splunk\etc\apps\process-windows-idx\appserver\addons\win_x86_64\Splunk_TA_windows\default\inputs.conf

After restarting the Splunk service and search using index=Process_tier1_idx but no results were displaying.

Please let me know how to get data in the index?
Thanks.

0 Karma
1 Solution

jacobpevans
Motivator

Greetings @prsubramanian,

For starters, never, ever, ever modify any file in the \default\ directory, EVER. If you ever go to upgrade your Splunk TA Windows app (which hopefully you will), all changes in \default\ will be overridden. This is expected, default Splunk behavior for all apps. Before you continue on, restore the \default\ folder back to what it was when you installed the app.

Once you've finished that, your issue is that the CPU counters listed are not in the [perfmon://Host Process] stanza. Instead of modifying the \default\ directory, copy \defaults\inputs.conf into \local\inputs.conf. Now, you can edit this file (in the \local\ directory).

Delete everything in this file except for this stanza: [perfmon://CPU].

This should be your entire \local\inputs.conf:

[perfmon://CPU]
disabled = 0
index = Process_tier1_idx

This will enable all CPU counters for you. A restart after making these changes will bring data to your index. If you'd only like some of the counters, feel free to further restrict them, e.g.:

[perfmon://CPU]
counters = % Processor Time
disabled = 0
index = Process_tier1_idx

followed by another restart.

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

jacobpevans
Motivator

Greetings @prsubramanian,

For starters, never, ever, ever modify any file in the \default\ directory, EVER. If you ever go to upgrade your Splunk TA Windows app (which hopefully you will), all changes in \default\ will be overridden. This is expected, default Splunk behavior for all apps. Before you continue on, restore the \default\ folder back to what it was when you installed the app.

Once you've finished that, your issue is that the CPU counters listed are not in the [perfmon://Host Process] stanza. Instead of modifying the \default\ directory, copy \defaults\inputs.conf into \local\inputs.conf. Now, you can edit this file (in the \local\ directory).

Delete everything in this file except for this stanza: [perfmon://CPU].

This should be your entire \local\inputs.conf:

[perfmon://CPU]
disabled = 0
index = Process_tier1_idx

This will enable all CPU counters for you. A restart after making these changes will bring data to your index. If you'd only like some of the counters, feel free to further restrict them, e.g.:

[perfmon://CPU]
counters = % Processor Time
disabled = 0
index = Process_tier1_idx

followed by another restart.

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

jacobpevans
Motivator

I also just noticed that your installation path does not look correct. I recommend deleting the Splunk_TA_Windows folder and reinstalling via the Splunk GUI. The path for any Splunk app or add-on should look like this:

$SPLUNK_HOME\etc\apps\Splunk_TA_windows

Where $SPLUNK_HOME is C:\Program Files\Splunk for your installation.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...